CCPA Compliance Requirements: The 2026 Operational Guide

Most CCPA explainers give the same advice: publish a privacy policy, add a cookie banner, and move on. That advice is incomplete. In 2025 and 2026, the difficult part of CCPA compliance requirements isn't explaining privacy rights. It's proving that your organization can execute those rights consistently across databases, vendors, employees, backups, automated systems, and audit records.

A policy can describe a deletion process that no operational team can complete. A consent interface can offer an opt-out that never reaches an advertising partner. An AI tool can make a significant decision while legal, HR, and engineering each hold only part of the evidence. California's current enforcement posture treats those gaps as operational weaknesses, not drafting imperfections.

Why a Privacy Policy Is No Longer Enough

A privacy policy remains necessary, but it is only the public description of a wider control system. California's statute and regulations require businesses to respond to verified consumer requests, instruct service providers and contractors on deletion, and keep records of how requests were handled. The California privacy statute and regulations make compliance depend on deadlines, routing, verification, and documentation.

The working question is whether the organization can execute the promise in its notice. A regulator may examine how the business identified the consumer, found relevant records, contacted downstream processors, applied exceptions, completed the requested action, and preserved evidence.

Practical rule: Treat every consumer right as a controlled business process with an owner, a deadline, an escalation path, and an evidence trail.

A static policy cannot show whether the customer database, ticketing platform, analytics environment, backup repository, and vendor systems connect to that process. It also cannot demonstrate that staff can separate a legitimate request from an attempted account takeover without imposing unreasonable friction on the consumer.

The evidence regulators can test

Operational readiness appears in artifacts that teams can retrieve and explain:

• Request records: Intake time, request type, verification result, assigned owner, status changes, response date, and reason for any denial.

• Data-location evidence: A current inventory showing where personal information is collected, stored, transformed, disclosed, or retained.

• Processor confirmations: Records showing that service providers and contractors received instructions and completed their part of the workflow.

• Policy alignment: Notices that match actual collection purposes, retention practices, sharing arrangements, and consumer-facing choices.

• System controls: Technical logs showing that access, deletion, correction, or opt-out actions occurred.

The operational test is reconstruction. Can the privacy team trace a request from intake through identity verification, system searches, vendor instructions, completion, and response using records that were created during the process?

Clear notices still matter. A resource such as Formcarry's privacy policy can help teams review how a web service presents privacy practices, but readable language does not replace internal execution. The policy must connect to workflows that teams can run repeatedly, measure against statutory deadlines, and reconstruct during an audit.

From 2025 through 2026, that distinction becomes more important as organizations address automated decision-making technology and other systems that distribute personal information across applications and vendors. Compliance is no longer demonstrated by holding a policy document. It is demonstrated by showing what happened, who acted, when each step occurred, and where exceptions were recorded.

Determining Whether Your Business Falls Under CCPA

A privacy policy cannot determine CCPA scope. The analysis depends on how the organization operates, what information it handles, and which entity controls those activities. A covered business generally operates for profit, does business in California, collects California residents' personal information, and determines the purposes or means of processing. It must also meet at least one applicable threshold described in the California Attorney General's CCPA guidance.

The revenue test is only the first screen. California's 2025 inflation adjustment raised the revenue threshold from $25 million to $26,625,000. An organization below that amount may still fall within scope because of the California consumer information it buys, receives, sells, or shares, or because of the share of revenue derived from selling that information.

Threshold	Original Value	2025 Adjusted Value	Key Consideration
Annual gross revenue	Above $25 million	Above $26,625,000	The revenue test can apply beyond revenue generated directly in California.
California consumers or households	100,000 or more	100,000 or more	Data volume can bring a mid-market company into scope even when revenue is below the revenue trigger.
Revenue from selling California residents' personal information	50% or more	50% or more	The revenue mix can matter more than total revenue.

A defensible scope review

Review every California-facing activity, not only customer purchases. Website analytics, account registration, support interactions, applicant information, employee data, advertising audiences, and information handled through affiliates may change the result. For each activity, identify the entity that decides why information is collected and how it is used.

Corporate structure often creates the hardest questions. A parent, subsidiary, commonly branded affiliate, or joint venture may require separate analysis of control, shared information, and intercompany arrangements. Record the conclusion in a dated scope memorandum. It should identify the facts reviewed, threshold calculations, excluded activities, related entities, assumptions, and approving owner.

The memorandum should be supported by evidence from finance, marketing, engineering, procurement, and data governance. Those records make the conclusion reviewable when systems or business models change.

What teams commonly miss

The 100,000-consumer threshold and the 50% revenue test require focused work. Marketing may know how many profiles enter an advertising platform, finance may know how revenue is categorized, and engineering may know which devices or households are represented. Each source can be accurate while still leaving the organization without a complete scope analysis.

Reassess scope after a new analytics provider, data partnership, acquisition, connected product, or advertising arrangement. These changes can affect coverage even when annual revenue remains stable. A documented, evidence-based decision gives the compliance team a defensible record. “We're not big enough” does not.

Operationalizing Consumer Rights Requests

Consumer rights requests expose whether a privacy program operates in practice. The difficult work starts after a consumer submits a form, when the request must move through the service desk, identity system, data warehouse, applications, and vendor network. A workable process uses one intake layer to classify the request, verify the requester, identify relevant systems, assign ownership, and record each decision.

The statute generally requires a business to complete a verified deletion request within 45 days, with a one-time extension of up to 45 additional days when reasonably necessary and when the consumer receives notice. The response clock continues while teams coordinate across departments and vendors. A queue in procurement, engineering, or a processor's ticketing system does not remove the business's responsibility.

Design the workflow around evidence

Verification should match the sensitivity of the request. The business needs sufficient confidence that it is responding to the correct person, while excessive identity demands can create barriers. Record the method, result, reviewer, and reason for any limitation or denial.

Routing should follow the data map rather than reporting lines. A right-to-know request may reach customer relationship management records, billing information, support correspondence, marketing platforms, product logs, and disclosures to third parties. A correction request needs controlled updates, or an older source may overwrite the corrected value during the next synchronization.

Deletion extends beyond a visible customer profile. The workflow should identify production records, connected applications, backups, and vendor-held information. If a retention obligation or another deletion exception applies, document the specific reason and the data that remains.

Opt-out requests require a preference record that follows the consumer across relevant systems. A clear “Do Not Sell My Personal Information” mechanism must be available where the consumer interacts with the business, rather than hidden in a general policy.

For 2025 and 2026 operations, policy language is only one control. The operating record should show the request timeline, task ownership, data sources queried, processor notifications, completion confirmations, and response communications. Teams assessing a compliance management system should test whether it produces that evidence without disconnected spreadsheets and email threads.

A deletion workflow isn't complete when an employee clicks “delete.” It's complete when the business can show what it searched, what it removed, what it instructed vendors to remove, what it retained, and why.

Run test requests before regulators or litigators do. Use controlled records to confirm that each system receives the correct instruction, exceptions reach legal review, deadline alerts trigger escalation, and the final response matches the underlying actions.

Building a Do Not Sell Framework and Managing Vendor Contracts

“Do Not Sell” compliance fails most often at the handoff between the business and its technology ecosystem. A website may record an opt-out while an ad-tech platform, analytics tool, or data partner continues processing the same identifier under a different account or channel.

The first task is classification. Review whether a disclosure is a sale, sharing for cross-context behavioral advertising, a business-purpose disclosure, or a service-provider relationship. Don't let a vendor's label settle the question. Examine the data exchanged, the recipient's permitted uses, the commercial arrangement, and whether the recipient can combine the information with data from elsewhere.

Propagate the choice, not just the contract

A strong framework has four connected layers:

• Collection layer: Capture the consumer's opt-out through a clear interface and recognize applicable browser or device signals, including Global Privacy Control where relevant.

• Preference layer: Store the decision against the identifiers and accounts used by the business, while controlling how identity matching is performed.

• Vendor layer: Send instructions to advertising, analytics, identity, and other recipients that process the relevant information.

• Assurance layer: Test whether each recipient stopped the prohibited activity and retain evidence of the test.

Contracts should prohibit unauthorized selling or sharing, restrict retention and use to defined business purposes, require cooperation with consumer requests, address downstream processors, and establish a practical method for confirming compliance. Legal language matters, but a clause that no one monitors is only an assumption.

Use a vendor register that connects each provider to the data categories it receives, processing purpose, contract status, sub-processors, opt-out method, deletion route, and responsible business owner. Periodic reviews should include configuration checks and sample transaction tracing, not just a questionnaire.

A short training explanation can help nonlegal teams understand why a marketing pixel may create a privacy obligation. This third-party due diligence framework is useful as a reference point for structuring that review around evidence, ownership, and escalation.

The following video can support internal discussions about vendor risk and operational accountability:

https://www.youtube.com/embed/y24eo9vEzco

Don't measure success by whether the opt-out link loads. Measure it by whether the choice reaches every relevant system and remains effective after data synchronization, account changes, and vendor handoffs.

Navigating Automated Decision-Making and Risk Assessment Rules

AI governance under the current CCPA framework starts with the decision being made, not the marketing label attached to the tool. The 2025 final regulations narrow ADMT to technology that replaces or substantially replaces human decision-making in significant decisions. A tool that supports a qualified reviewer isn't automatically equivalent to a system that makes the decision without meaningful human authority.

That distinction matters in employment, lending, housing, education, healthcare, and similar contexts. A recruiter may use a model to organize applications, but the compliance analysis changes if the model's output effectively determines who advances and the human reviewer lacks the knowledge or authority to change the result.

Document the human role

For every potentially relevant system, record:

• Purpose: What exact decision does the technology support or make?

• Inputs: Which personal information categories influence the output?

• Output: Is the result a recommendation, score, classification, prediction, or final decision?

• Human control: Can the reviewer interpret the output, examine other relevant information, and change the decision?

• Consumer notice: What does the pre-use notice explain about the system, purpose, opt-out, and access rights?

• Alternative path: What happens when a consumer opts out or seeks human review?

Generic descriptions such as “we use AI to improve services” won't give a consumer meaningful information about a significant decision. The documentation should explain the specific purpose and how the output affects the outcome without disclosing protected information unnecessarily.

Risk assessments should be treated as living governance records. Independent legal commentary on the finalized regulations notes that assessments must be updated within 45 calendar days after material changes, as summarized by Grant Thornton's CCPA privacy update. A model replacement, new data source, changed decision threshold, expanded population, or new purpose can therefore trigger reassessment.

Keep the assessment operational

Assign participation across privacy, legal, security, data science, HR, and the business owner. Record the intended benefit, foreseeable privacy risks, safeguards, alternatives, testing results, approval decision, and change history. If the organization uses an internal governance platform, its role should be evidence management and workflow coordination, not autonomous judgment. US regulations for Logical Commander provides one example of how a vendor may describe regulatory alignment, but your own assessment still needs to establish whether the specific deployment complies with the applicable rules.

Understanding Enforcement Realities and Financial Penalties

Enforcement is now an operating risk, not a theoretical exposure. The California Privacy Protection Agency announced its first CCPA enforcement action on March 12, 2025, then published an update covering July 6, 2023 through March 31, 2026, as discussed in Wiley's analysis of the CPPA's first enforcement action. Businesses need records that show how controls work in practice, not policies that merely describe intended behavior.

California's 2025 penalty adjustment sets civil penalties at $2,663 per violation and $7,988 per intentional violation, with higher penalties for certain minors' data violations. The California Attorney General's CCPA materials provide related regulatory information. The exposure can expand when one defect affects numerous consumer records, interfaces, or processing activities.

What enforcement exposes

Regulators can test whether business promises match system behavior. A policy may promise deletion while a vendor retains the record. A consumer may select an opt-out while an advertising configuration continues sharing data. A company may describe meaningful human review while managers routinely accept an automated score.

Prepare the evidence package before an inquiry:

• Governance records: Scope decisions, approvals, policies, training records, and risk assessments.

• Technical evidence: Data maps, system configurations, access logs, deletion logs, and preference propagation records.

• Vendor evidence: Contract terms, processor instructions, confirmations, testing results, and remediation tickets.

• Request evidence: Verification, correspondence, decisions, exceptions, completion dates, and quality checks.

Regulatory penalties are only one exposure. The CCPA also provides a private right of action for certain data breaches involving failure to maintain reasonable security safeguards. A breach can therefore create litigation risk beyond the regulator's penalty framework, including claims pursued collectively by affected consumers.

A mature program tests its own evidence. Conduct mock investigations, sample completed requests, verify vendor responses, and assign remediation deadlines to named owners. The practical standard is simple: an auditor should be able to trace a requirement from approval through configuration, execution, and retained proof.

Your CCPA Compliance Checklist for 2026

A useful checklist assigns every task to a department and names the evidence that proves completion. “Review privacy policy” is too vague. “Privacy counsel approves the updated notice, product publishes it at collection, and the change record links the approved version to the affected data inventory” is testable.

Immediate actions

• Confirm scope, owned by Legal and Finance: Recalculate the revenue, consumer-data, and revenue-mix tests using documented business records. Preserve the analysis and approval.

• Map personal information, owned by Privacy and IT: Record collection points, sources, purposes, systems, retention logic, vendors, and sharing destinations.

• Test rights intake, owned by Customer Operations: Submit controlled access, deletion, correction, and opt-out requests. Capture verification, routing, completion, and escalation evidence.

• Review notices, owned by Privacy and Product: Reconcile the privacy policy and collection notices with actual data practices, including sensitive information and automated decision-making uses.

• Classify vendors, owned by Procurement and Legal: Identify service providers, contractors, third parties, and downstream processors. Confirm that contracts and operating procedures match the classification.

• Assess ADMT, owned by Data Science, HR, and Legal: Inventory tools that replace or substantially replace human decisions, then document purpose, inputs, outputs, human authority, notice, and appeal or opt-out handling.

Ongoing governance

Quarterly reviews should sample completed consumer requests and trace at least one action from intake through each relevant system. Privacy Operations should monitor deadline exceptions, unresolved vendor tasks, recurring verification failures, and records that cannot be located.

Security, IT, and Privacy should review retention and disposal controls together. Keeping unnecessary personal information creates more systems to search, more vendors to notify, and more evidence to preserve. Data minimization is therefore an operational efficiency decision as well as a privacy control.

Training belongs with the people who handle requests, configure tracking technologies, approve vendors, operate HR systems, and manage automated tools. Keep attendance records, practical exercises, escalation rules, and updated procedures. A mature program schedules recurring vendor reviews, reassesses material changes to automated systems, and preserves decisions in a centralized evidence repository.

The publisher's E-Commander platform from Logical Commander Software Ltd. is one option organizations may evaluate for centralized compliance tracking, mitigation workflows, dashboards, and evidence documentation across departments. Teams should assess any platform against their own data architecture, access controls, retention rules, and CCPA workflow requirements before adoption.

---

Logical Commander Software Ltd. offers E-Commander for centralized compliance workflows, evidence documentation, and cross-department accountability, with Risk-HR providing structured indicators for ethical and operational risk while keeping human decisions in organizational hands. Visit Logical Commander Software Ltd. to evaluate whether its platform fits your CCPA governance, auditability, and internal risk-management needs.